TI-2019-00242 Aliases CVE-2019-0281 GHSA-5h33-prjx-rr5j

Cross-site scripting in SAP OpenUI5

LOW 30CWE-79Published 2019-07-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Why it matters now

EPSS 0.01325 71st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	OpenUI5	1.38.39; 1.44.39; 1.52.25; 1.60.6; 1.63.0	—	No fix listed	CNA
SAP	SAPUI5	1.38.39; 1.44.39; 1.52.25; 1.60.6; 1.63.0	—	No fix listed	CNA

OpenUI5 VendorSAP Affected 1.38.39; 1.44.39; 1.52.25; 1.60.6; 1.63.0 Fixed in — No fix listed CNA
SAPUI5 VendorSAP Affected 1.38.39; 1.44.39; 1.52.25; 1.60.6; 1.63.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:openui5::::::::	before 1.38.39; 1.40.0 to before 1.44.39; 1.50.0 to before 1.52.25; 1.60.0 to before 1.60.6	Vulnerable	SAP

cpe:2.3:a:sap:openui5:*:*:*:*:*:*:*:* Versions before 1.38.39; 1.40.0 to before 1.44.39; 1.50.0 to before 1.52.25; 1.60.0 to before 1.60.6 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-0281
2026-10-03 Alias added: GHSA-5h33-prjx-rr5j

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences